rns.recipes

I've updated the stats output in rnstatus quite a bit, so it now provides much more detailed overviews of the overall traffic flow composition.

$ rnstatus -qPAltmI1 bern

 BackboneInterface[Bern IPv4/0.0.0.0:7822]
    Status    : Up
    Clients   : 369
    Blocked   : 22 IPs
    Mode      : Gateway
    Rate      : 10.00 Mbps
    Path Rqs. : ↑1.9 KHz    5.2 Hz/c (↓0% / ↑0% of flow)
                ↓14.5 Hz    burst on 8 for 14m and 6.02s
    Announces : 128.9 Hz↑   0.3 Hz/c (↓7% / ↑23% of flow)
                91.6 Hz ↓  (t:6h/p:0s/g:1) burst on 4 for 13m and 25.51s
    Traffic   : ↑320.04 MB  2.56 Mbps
                ↓189.04 MB  2.16 Mbps

 Totals       : ↑329.26 MB  2.61 Mbps, 74% data (1.94 Mbps)
                ↓194.91 MB  2.19 Mbps, 92% data (2.02 Mbps)

 Path Rqs.    : ↑46.25 MB  8.57 Kbps, 0% of flow, 71.55 Hz
                ↓1.12 MB   7.49 Kbps, 0% of flow, 19.30 Hz

 Announces    : ↑127.20 MB  654.45 Kbps, 25% of flow, 80.24 Hz
                ↓30.88 MB   163.44 Kbps, 7% of flow, 91.41 Hz

 Qu. Pressure : 0.2% total, 16 pkts, 4154 dropped
                0.2% data, 11 pkts
                0.0% announce, 0 pkts, 974 dropped
                0.4% path request, 1 pkts
                100.0% ingress limiter, 4 pkts, 3180 dropped

 Transport Instance <521c87a83afb8f29e4455e77930b973b> running
 Probe responder at <b5ee8c126d477731f9a750ea05e4747f> active
 Uptime is 14m and 7.93s, 5053 entries in link table (5035 active)

There's also additional announce/pr stats and sorting options, making it a lot easier to identify nodes doing weird shit. Like this one, who just sent 12678 path requests in 20 minutes:

BackboneInterface[Client on Bern IPv4/79.135.105.3:8420]
    Status    : Up
    Mode      : Gateway
    Rate      : 10.00 Mbps
    Path Rqs. : 12678↓ 2619↑ total
                2.8 Hz↑    (↓0% / ↑0% of flow)
                8.6 Hz↓     burst for 20m and 0.17s
    Traffic   : ↑656.90 KB  0 bps
                ↓1.49 MB    0 bps

If 79.135.105.3 is you, it might be worth checking what your machine is up to.

Interestingly, practically all of those PRs seem like random destination hashes, and therefore completely bogus. Whether it's malice or incompetence, I cannot say.

And by random/bogus, I mean that the requested hashes did not correlate to anything heard announced on the network within the last 21 days or so. From a list of 1.7M announces heard, only ~200 of those path requests matched known destinations at all.

Also, just to be clear, there's nothing indicating that the node at that IP is itself necessarily doing anything malicious. It could simply be another client connecting to that node, and dumping massive amounts of path requests, and the node having no ingress/egress control activated (on an old version, or just misconfigured), so everything is just passed along. Either way, a good example of why disabling burst control is a bad idea.

Mark wrote:

And by random/bogus, I mean that the requested hashes did not correlate to anything heard announced on the network within the last 21 days or so. From a list of 1.7M announces heard, only ~200 of those path requests matched known destinations at all.

[image]

A stats collector? Is that available anywhere?